Opkssh integrating single sign-on with SSH (2025)
ethanheilman.com
ethanheilman.com
Just by looking at the diagram, the mere presence of a third-party IdP is enough for most of enterprise and homelab to be deterred and look elsewhere for a more self-contained self-host identity provider server.
But then again, I could be wrong.
Still, using certificate in OpenSSH (instead of public key) is easier for me once it starts to scale beyond 5 or more hosts. Even do dual-cert, by host and by user combo, while using brittle OpenLDAP-OpenSSH for other class of users.
And smashed all my notes on certificates and OpenSSH on my ad-free, revenue-free, JS-free Pelican blog. It's personal on both note-wise and server.
Oh, certain browser will not work with this blog if it cannot negotiate ONLY for Cha-Cha/Poly. It's by design as a showcase of why that particular web browser refuses to do that.
https://egbert.net/blog/articles/ssh-openssh-certificates.ht...
> Still, using certificate in OpenSSH (instead of public key) is easier for me once it starts to scale beyond 5 or more hosts. Even do dual-cert, by host and by user combo, while using brittle OpenLDAP-OpenSSH for other class of users.
SSH certificates are fantastic. OPKSSH wouldn't work without them.
> And smashed all my notes on certificates and OpenSSH on my ad-free, revenue-free, JS-free Pelican blog. It's personal on both note-wise and server.
Will check it out.